Closed Bug 1245416 Opened 4 years ago Closed 4 years ago

Assertion failure: result ([OOM] Is it really infallible?), at js/src/ds/LifoAlloc.h:281 involving js::jit::MConstant::New

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla47
Tracking Status
firefox47 --- fixed

People

(Reporter: gkw, Assigned: nbp)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, regression, Whiteboard: [jsbugmon:ignore])

Attachments

(1 file)

+++ This bug was initially created as a clone of Bug #1245178 +++

Nicolas requests that each stack should have it's own bug, blocking meta bug 1244824. Assigning to him by default.

Line numbers from m-c rev 5f9ba76eb3b1:

#0  0x000000000060083c in js::LifoAlloc::allocInfallibleOrAssert (this=0x4711ea0, n=120) at /home/ubuntu/trees/mozilla-central/js/src/ds/LifoAlloc.h:281
#1  0x00000000006007a5 in js::jit::TempAllocator::allocateInfallible (this=0x48067f0, bytes=120) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:40
#2  0x00000000005ff24d in js::jit::TempObject::operator new (nbytes=120, alloc=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/JitAllocPolicy.h:174
#3  0x00000000008ddd57 in js::jit::MConstant::New (alloc=..., v=..., constraints=0x0) at /home/ubuntu/trees/mozilla-central/js/src/jit/MIR.cpp:685
#4  0x00000000007e5361 in js::jit::EliminateDeadResumePointOperands (mir=0x4806990, graph=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonAnalysis.cpp:939
#5  0x00000000007ba639 in js::jit::OptimizeMIR (mir=0x4806990) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:1686
#6  0x00000000007bc25b in js::jit::CompileBackEnd (mir=0x4806990) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2008
#7  0x0000000000d47664 in js::HelperThread::handleIonWorkload (this=0x3ebd1f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1276
#8  0x0000000000d46ef4 in js::HelperThread::threadLoop (this=0x3ebd1f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1603
#9  0x0000000000d44bac in js::HelperThread::ThreadMain (arg=0x3ebd1f0) at /home/ubuntu/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1204
#10 0x0000000000e6196b in nspr::Thread::ThreadRoutine (arg=0x3ec29e0) at /home/ubuntu/trees/mozilla-central/js/src/vm/PosixNSPR.cpp:45
#11 0x00007f5b62c1c6aa in start_thread (arg=0x7f5b61789700) at pthread_create.c:333
#12 0x00007f5b61c92eed in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
Summary: Assertion failure: result ([OOM] Is it really infallible?), at js/src/ds/LifoAlloc.h:281 involving js::jit::Range::NewUInt32Range → Assertion failure: result ([OOM] Is it really infallible?), at js/src/ds/LifoAlloc.h:281 involving js::jit::MConstant::New
Attachment #8720796 - Flags: review?(hv1989) → review+
https://hg.mozilla.org/mozilla-central/rev/11b46fbed710
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla47
You need to log in before you can comment on or make changes to this bug.